Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[UD-1580] Remove kube-rbac-proxy #324

Merged
merged 4 commits into from
Dec 10, 2024
Merged

Conversation

matheusfm
Copy link
Contributor

Description

This PR removes kube-rbac-proxy container to use WithAuthenticationAndAuthorization.

The kustomize files are also updated according to the latest kubebuilder version scaffold.

Linked Issues

Closes #323
Closes undistro/helm-charts#4

How has this been tested?

# Create Kind cluster
kind create cluster

# Install the latest release of Zora
helm install zora undistro/zora -n zora-system --create-namespace --wait --set clusterName=kind-kind

# Bind the "zora-operator-metrics-reader" role to the default service account in zora-system namespace
kubectl create clusterrolebinding metrics-reader --clusterrole=zora-operator-metrics-reader --serviceaccount=zora-system:default

# Create a Pod in zora-system namespace (which will use the default service account) containing the curl command
kubectl -n zora-system run curl-$RANDOM --image=radial/busyboxplus:curl --rm=true -i --tty

# From the curl Pod, calls the /metrics API providing the service account token.
curl -s -k -H "Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" https://zora-metrics:8443/metrics
# Note that without the toke, the request fails

# OK, the metrics should be working through the proxy.

# Open another terminal session

# Checkout this branch
git fetch; git checkout UD-1580-remove-kube-rbac-proxy

# Build the images from this branch
make kind-load-images

# Uninstall Zora
helm uninstall zora -n zora-system

# Install Zora from the current branch
helm install zora ./charts/zora -n zora-system --create-namespace --wait --set clusterName=kind-kind \
--set scan.worker.image.repository=worker \
--set scan.worker.image.tag=latest \
--set operator.image.repository=operator \
--set operator.image.tag=latest

# Go back to the curl pod and the same request should keep working!

Checklist

  • I have labeled this PR with the relevant Type labels
  • I have documented my code (if applicable)
  • My changes are covered by tests

@matheusfm matheusfm added the enhancement New feature or request label Dec 5, 2024
@matheusfm matheusfm requested a review from knrc December 5, 2024 18:18
@matheusfm matheusfm self-assigned this Dec 5, 2024
@matheusfm matheusfm merged commit d0581a2 into main Dec 10, 2024
4 checks passed
@matheusfm matheusfm deleted the UD-1580-remove-kube-rbac-proxy branch December 10, 2024 16:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
2 participants